3 ms·
STIGs apply to DoD systems administered by DoD staff or contractors. SCAP scans have similar scope. Commercial cloud is covered by CCSRGs. This is Microsof
by stonogo 3y ago
STIGs apply to DoD systems administered by DoD staff or contractors. SCAP scans have similar scope. Commercial cloud is covered by CCSRGs. This is Microsoft's problem.
- thereddaikon 3y agoThe system owner is responsible for security of systems they have deployed on Fedramp services. Microsoft is responsible for securing the service but they don't make sure every vm you spun up on Azure meets your own security baselines. Those vary not just between agency but even specific site. Expecting the vendor to do all of that is an impossible task.
- xcrunner529 3y agoThe email is run as a service isn’t it?
- thereddaikon 3y agoYes and know. The implication of it being an "unsecured email server" to me sounds like they spun up a VM for some reason instead of using Exchange online.
- thereddaikon 3y agowow know. Not sure how I managed that one.